Chain of Trust Findings
A server sends its certificate and the intermediate certificates that link it to a root certificate the client already trusts. The check verifies that chain against the public trust store, or against the private CAs on the monitor's profile.
To confirm any fix on this page, click Check Now on the monitor's page. openssl s_client -connect example.com:443 -servername example.com -showcerts prints every certificate the server sends, in order.
CERT_TRU01: Chain not trusted by the monitor's private CA
Key: CERT_TRU01 · Label: Not Trusted · Severity: Error · Can be dismissed: No
What it means: the certificate chain couldn't be verified against the private CA set on the monitor's profile.
Why it matters: clients that trust only your private CA will reject the certificate.
How to fix it: check that the certificate was issued by that private CA, and that the server sends its intermediate certificates. If the private CA has expired or been replaced, import the new CA and assign it to the same profiles: an expired private CA isn't used for verification.
CERT_TRU02: Chain not trusted by public CAs
Key: CERT_TRU02 · Label: Not Trusted · Severity: Error · Can be dismissed: No
What it means: the certificate chain isn't trusted: the certificate may be self-signed, issued by a CA that isn't publicly trusted, or the server may not be sending an intermediate certificate.
Why it matters: browsers and clients reject the connection. A missing intermediate is easy to miss, because some browsers fetch or cache it while other clients don't.
How to fix it: install the full chain (the certificate followed by its intermediates) on the server, or use a certificate from a publicly trusted CA. For an internal service with its own CA, import the CA and assign it to the monitor's profile.
CERT_TRU03: Root certificate sent in the chain
Key: CERT_TRU03 · Label: Root Sent · Severity: Notice (a suggestion) · Can be dismissed: Yes
What it means: the server sends its root certificate as part of its certificate chain. The Certificate Report shows that root once, as the chain's CA, marked Also sent by the server.
Why it matters: clients already have the root, so sending it adds to every handshake for nothing. A root that doesn't match the client's own copy, such as an old cross-signed or expired root, can break older clients.
How to fix it: leave the root out of the server's certificate chain file: send the certificate and its intermediates only.